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(57) Abstract: The invention relates to a lift system, comprising a lift cabin (12), 
-jg 17 with a cabin door (131), which moves along a lift shaft wall (11.1), pro\ided with 




shaft doors (13) and a controller (16), with recording means (20; 18), arranged in 
the vicinity of the shaft doors (134) and/or in the vicinity of the cabin door(s) (131), 
for providing fault information to the controller (16). A status determining unit is 
provided, wliich is connected to tlie controller (16) and which provides tlie same with 
status information on tlie position and the speed of the lift cabin (12). Tlie lift system 
is chanicleri scd in ihaL one of the lucording means (20; 1 8) provides fault infoimalion 
on the type of fault and position of the fault to the controller (16), in the case of 
a fault in the vicinity of one of the shaft doors (13), or the cabin doors (131), the 
controller (16) triggers a situation -dependent, safe reaction, depending on the type 
of fault, the position of the fault and the status information in order to guarantee a 
residual functionality of the lift cabin (1 2), despite the fault. 

(57) Zusammeafassuog: Aufzugsyslcm mil cincr cine Kabincntiirc (131) aufwci- 
scndcn Aufzugkabinc (12), die cntlang cincr mil Schachttlircn (13) vcrschcncn Auf- 
zugschachtwand (11.1) bewegt wind, mit einer Steuerung (16), mit Erfassungsmit- 
tebi (20; 18), die im Bereich der SchachttUren (13) und/oder im Bereich der Kabi- 
nentuTe(n) (131) angeordnet sind und der Steuerung (16) Stflrungsin formation zur 
Verfiigung stellen. Rs ist eine Zustandserfassungseinheit vorgesehen, die mit der 
Steuerung (16) in Verbindung sleht und dieser Zustandsinformation iiber die Position 
und die Geschwindigkeit der Aufzugkabine (12) zur Verfugung stellt. Das Aufzug- 
systera zeichnet sich daduich aus, dass eines der Erfassungsmittel (20; 18) im Fall 
einer StOrung im Bereich einer der SchachUuren (13) oder der Kabinenturen (131) 
der Steuerung (16) StOrungsinformalion iiber StOrungsarl und Position der Slc3rung 
zur VerfUgung stellt, die Steuerung (16) unter Berticksichtigung der StGrungsart, der 
Position der SiOrung und der Zustandsinfonnation eine situationsabhangige, sichere 
Reaktion auslost, um trotz der Stoning eine Restverfiigbarkeit der Aufzugkabine (1 2) 
zu gewMhrieisten. 
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Situation-dependent reaction in the case of a fauit in the region of a door of a iift 
system 

The present invention relates to a lift system and a lift controller. The lift systenn comprises 
5 a lift cabin which is moved by a drive unit along a lift shaft wall provided with shaft doors, 
wherein this shaft wall can be part of a lift shaft closed all around by shaft walls or 
constructed to be wholly or partly open at one or more sides. 

There is known from the patent specification US 4 898 263 a monitoring device for lift 
10 systems which generates on each occasion in accordance with a self-diagnostic process a 
specific reaction for concrete fault cases in order, in particular, to reduce the speed of a lift 
cabin or in order to stop it. It is also known, for example from the patent specification WO 
00/51929, to use in systems of that kind different redundantly operating sensors, 
changeover switches and microprocessors as well as a data bus. 

15 

Since such systems are quite complex, they have proved to be relatively complicated and 
costly. It is therefore the object of the invention to create a lift system which ensures a 
higher degree of operational reliability and functionality with comparatively little outlay. 

20 According to the invention this object Is met in advantageous manner by a lift system 
according to patent claim 1 and by a lift controller according to claim 13. 

Other advantageous embodiments of the invention are evident from the respective 
dependent claims. 

25 

The invention is explained in more detail by way of example in the following by reference 
to the drawings, in which: 

Fig. 1 shows a schematic illustration of a lift shaft with a controller, which is 

30 connected by way of individual lines with different elements of the lift 

system. 
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Fig. 2 shows a schematic illustration of a lift shaft with a controller, with which 

different elements of the lift system are connected by way of at least one 
bus. 

5 Fig. 3 shows a flow chart for explanation of the mode of operation of an 

embodiment of the lift system according to the invention and 

Fig. 4 shows a block circuit diagram of a lift controller with several modules for 

such a lift system. 

10 

A first lift system according to the present invention is shown in Fig. 1. The illustrated lift 
system comprises a lift cabin 2 with at least one cabin door 9 and a drive unit 7 for moving 
the lift cabin 2 along a lift shaft 1.1, which is provided with shaft doors 3, of a lift shaft 1. A 
controller 6 is provided for controlling the drive unit 7. On each storey there are. in the 

15 region of the shaft door 3, detecting means 5 which are connected with the controller 6 by 
way of individual lines 51, 52 and 53. In addition, such detecting means 8 are mounted at 
the lift cabin 2. preferably in the region of the cabin door 9. The detecting means 5 make 
available fault information to the controller 6 by way of the lines 51 , 52 and 53 and the 
detecting means 8 make available fault information to the controller 6 by way of the line 

20 55, In the case of a fault in the region of one of the shaft doors 3 or the cabin door 9 the 
controller 6 has available, for example, fault information about the kind of fault and about 
the position (for example, storey 2) of the fault. The lift system according to the invention 
additionally comprises a status detecting unit (not shown in Fig. 1), which can detect the 
instantaneous position and the speed of the lift cabin 2. The status detecting unit is 

25 connected with the controller 6 by way of a line (not shown in Fig. 1), Through this line the 
controller 6 has available information about the instantaneous position and about the 
speed of the lift cabin 2. Preferably, the status detecting unit also makes available 
information with respect to the direction of movement of the lift cabin 2. 



30 According to the present invention the controller 6 determines, with consideration of the 
kind of fault, the position of the fault and the status information, a situation-dependent, safe 
reaction. Thus, a certain residual functionality of the lift cabin 2 is guaranteed 
notwithstanding fault. The general functionality of the lift system can thereby iDe 
enhanced. 
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As shown in Fig. 1, further detecting means 4 can be present at the shaft 1, which is 
constructed to be open or closed, the further detecting means being connected with the 
controller 6 by way of a line 54. Through such further detecting means 4 there can be 
5 made available to the controller 6 additional infonnation which can find consideration in the 
determination of a suitable reaction. 

The detecting means 5 are not part of a conventional safety circuit, since such a safety 
circuit would be directly interrupted in the case of occurrence of a fault in the region of the 
10 lift cabin 2, A situation<lependent safe reaction would then not be possible in such a 
case. 

The temi 'detecting means' comprises inter alia sensors, switches (for example, magnetic 
switches), changeover switches, door contacts, light barriers, movement and contact 

15 sensors, proximity sensors, relays and other elements which can be used in order to 
monitor the shaft doors, the environment of the shaft doors, the cabin door or doors and 
the lift shaft, to check the state thereof and to recognise faults of any kind in the shaft door 
region and/or in the cabin door region. In particular, the detecting means can be safety- 
relevant means coming into use in the systems according to the invention. The detecting 

20 means can also consist of a combination of several of the stated elements. 

In the fonn of embodiment shown in Fig. 1 the detecting means 5 and 8 are directly 
connected with the controller by way of lines 51 to 53 and 55. The detecting means 5 and 
8 can be interrogated from the controller 6 or the detecting means 5 and 8 automatically 
25 transmit information to the controller 6. 

A further lift system according to the present invention is shown in Fig. 2. The illustrated 
lift system comprises a lift cabin 12 with at least one cabin door 131 and a drive unit 17 for 
moving the lift cabin 12 along a lift shaft wall 1 1.1. which is provided with shaft doors 13. of 
30 a lift-shaft 11. A controller 16 for controlling the drive unit 17 is provided. On each storey 
there is. in the region of the shaft doors 13, detecting means 20 which are connected with 
the controller 16 by way of a bus 15. The detecting means 20 make fault information 
available to the controller 16 by way of storey nodes 10 and the bus 15. Detecting means 
18 are mounted in or at the lift cabin 12 in the region of the cabin door 131. The detecting 
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means 18 are preferably connected with the controller 16 by way of a node 101 and a bus 
151. The illustrated lift system moreover comprises a status detecting unit (not shown in 
Fig. 2) which can detect the instantaneous position and the speed of the lift cabin 12. In 
addition, the status detecting unit is preferably connected with the controller 16 by way of a 

5 node and a bus {not shown in Fig. 2). The controller 16 has available information about 
the instantaneous position and about the speed of the lift cabin 12 via the bus which is 
either a separate bus associated only with the status detecting unit or in which it is the bus 
151 used by the detecting means 18. In the case of a fault in the region of one of the shaft 
doors 13 or in the region of the cabin door 131 the controller 16 thus has available, for 

10 example, fault information about the kind of fault and about the position of the fault. 

The status detecting unit preferably also makes available information with respect to the 
direction of movement of the lift cabin 12. 

15 As shown in Fig. 2, further detecting means 14 can be present at the shaft 11, which 
further detecting means are connected by way of a node 19 and the bus 15 with the 
controller 16. Through such further detecting means 14 there can be made available to 
the controller 16 additional information which can find consideration in the determination of 
a suitable reaction. 

20 

The fault Information has to be made securely available to the control unit in order to be 
able to ensure that the entire lift system is operationally safe in every situation and under 
all circumstances. For this purpose the fault information can be transmitted, for example, 
safely by way of the bus. For this purpose there are the most diverse possibilities of 
25 realisation, which are not described In detail here since these are sufficiently known to the 
exper. Transmission en-ors can be prevented by suitable measures or, if these cannot be 
avoided, transmission errors must at least be able to t>e detected and thus also able to be 
eliminated. 

30 In order to enable a secure transmission of the fault infonmation, various concepts, which 
are known per se, from communications technology can be used. In an advantageous 
form of embodiment the bus 15 and/or the bus 151 is a so-termed safety bus as is also 
used in other lift systems. 
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As described in connection with Figures 1 and 2, a status detecting unit is preferably 
located in or at the lift cabin 2 or 12. The status detecting unit is preferably connected with 
the controller 16 by way of the cabin bus (for example, the cabin bus 151). A safety bus is 
usually used as cabin bus. 

5 

A lift system according to the invention preferably comprises storey nodes 10 which are 
designed in such a manner that signals from the detecting means 20 of the respective 
storey are provided at inputs of the storey node 10, wherein the storey nodes 10 process 
these signals in order to be able to make corresponding fauK information available to the 

10 controller 16. The same also applies to the cabin node 101, which obtains signals from 
the detecting means 18 and processes these in order to be able to make con-esponding 
fault infonmation available to the controller 16. The storey nodes 10 and the cabin node 10 
can also be equipped with a certain degree of intelligence, for example in the form of a 
software-controlled processor, in order to undertake local decisions and possibly even to 

15 be able to take over certain control functions. 

A further form of embodiment of a lift system is distinguished by the fact that the detecting 
means 20 or 18 and/or the status detecting unit is or are connected with the controller 16 
by way of a safety bus. 

20 

Ideally, a permanent detection of the status of the lift cabin 2 or 12 is earned out. In the 
case of a digital embodiment the detecting means and/or the status detecting unit is or are 
frequently sampled in order to be able to ensure a quasi-continuous information and status 
detection. The controller 6 or 16 is thus informed at all times about the position, speed 
25 and, depending on the respective form of embodiment, also about the direction of travel of 
the lift cabin 2 or 12. By contrast, in the case of the monitoring device described in patent 
specification US 4 898 263 there are provided, at the shaft, means which co-operate with 
means at the lift cabin as soon as the cabin approaches a storey. Thus, a permanent or 
quasi-continuous detection is not present according to patent specification US 4 898 263. 

30 

A further lift system is, according to the present invention, so designed that it is separately 
ascertainable by the detecting means 5 or 20 whether a gap formed by an incorrectly 
closed shaft door 3 or 13 is substantial or insubstantial. If an insubstantial gap at a shaft 
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door is detected then, by way of example, one of the six following situation-dependent 

reactions can be triggered: 

Movement of the lift cabin to behind the shaft door concerned. Opening and 
closing of the shaft door in that the cabin door is opened and closed. Checking 
whether the insubstantial gap continues to exist. If so. trigger service call. 
Checking whether the information delivered by the detecting means in the region of 
the shaft door concerned is plausible/correct with respect to the presence of an 
insubstantial gap. This can be carried out, for example, in that redundantly- 
executed sensors are Interrogated in the detecting means. If the supplied 
information is plausible/correct, the lift cabin can be moved to behind the shaft door 
concerned, the shaft door opened and closed in that the cabin door is opened and 
closed, and it can be checked whether the insubstantial gap continues to exist. If 
so, a service call is triggered. 

Trigger a service call independently of what results from checking the infonnation 
made available or independently of whether such checking was even carried out. 
Continuing to deal with the traffic in the region in which all shaft doors are in order 
(denoted as permitted zone). If travel outside the permitted zone is desired, in 
which the affected shaft door would have to be passed, giving an acoustic 
communication that the desired storey cannot be travelled to for the moment. Wait 
for a new storey selection by passengers or let passengers disembark and trigger a 
service call. The storey in which the fault was detected in the region of the shaft 
door is termed risk zone or non-permitted zone, wherein in the case of an 
insubstantial gap no direct risk is actually present. 

Travel to the desired storey if in that case the affected shaft door or the non- 
permitted zone do not have to be passed. Othenvise. travel to the next possible 
storey, let passengers disembark and place a service call. 
Place service call and continue to travel normally. 

If a substantial gap is present at one of the shaft doors, then, for example, one or more of 
the following situation-dependent reactions can be triggered: 

Maintenance of operation of the lift cabin, preferably at reduced speed, so that the 
lift cabin can be moved in controlled manner to one of the next storeys without in 
that case having to travel through the non-permitted zone. 
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Trigger an emergency call in the case of lift stoppage or place a service call if the 
lift can still be operated. 

If the lift cabin is located at the storey with the shaft door fault, then the shaft door 
is opened and closed again by opening and closing the cabin door. If the fault 
5 continues to be present, a sen^ice call Is placed. The lift cabin is not placed in 

motion. The passengers are required to disembark and optionally required to use 
a neighbouring lift cabin. 

The controller of the lift prevents persons from being placed at risk, in that the lift 
cabin is moved directly below the faulty shaft door and kept there. Thus, in certain 

10 circumstances a person can be prevented from entirely opening the shaft door and 

falling into the lift shaft. If the gap is large, it can also happen that a person forces 
through the gap. In this case, too, falling into the lift shaft is prevented. 
Another, secondary reaction is: the lift cabin travels to the affected storey behind 
the affected shaft door, for example in creeping motion and without passengers. 

15 The passengers have previously disembarked at an unaffected storey. 

The controller can attempt to close the faulty shaft door by repeated actuation. If 
this attempt succeeds, the lift system can be transferred back into the normal 
operational state. 

The lift is usually shut down if the substantial gap continues to exist. 

20 

In the case of the situation-dependent reactions, different reactions can be triggered 
depending on whether the lift cabin is at rest or whether this moves. If in the case of a lift 
cabin at rest a problem is discovered in the region of the shaft door at the storey of which 
the lift cabin is just present, then there is not even onward movement, but the cabin door 
25 is. together with the shaft door, opened again and then once more dosed in order to 
attempt to eliminate the fault. 



In a further form of embodiment detecting means can be provided by which it can be 
established whether the cabin door 9 or 131 has a substantial or insubstantial gap. If an 
30 insubstantial gap at a cabin door is detected, then, for example, one of the following 
situation-dependent reactions can be triggered: 

Maintenance of the operation of the lift cabin so that the lift cabin can continue to 
be moved. Opening and closing of the cabin door at the next stop. Checking 
whether the insubstantial gap continues to exist. If so, trigger service call. 
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Check whether the information, which is delivered by the detecting means in the 
region of the cabin door, with respect to the presence of an insubstantial gap is 
plausible/correct. This can be carried out, for example, in that redundantly 
executed sensors in the detecting means are interrogated. If the supplied 
5 Information is plausible/correct, the cabin door is opened and closed in order to 

check vyAiether the insubstantial gap continues to exist. If so, trigger a service call. 

Trigger the service call independently of the result of checking of the information 
made available or independently of whether such a check was even undertaken. 
10 - Restricted travel operation at reduced speed until the fault is eliminated. 
Place a service call and continue to travel nomialiy. 

If a substantial gap is present at the cabin door, then, for example, the following situation- 
dependent reaction can be triggered: 
15 - Maintenance of operation of the lift cabin, preferably at reduced speed, so that the 

lift cabin can be moved in controlled manner to one of the next storeys. 

Trigger an emergency call. 

If the lift cabin is at rest, then the cabin door is opened and closed again. If the 
fault continues to exist, a sen/ice call is placed. The lift cabin is not placed in 
20 motion. The passengers are required to disembark and optionally required to use 

a neighbouring lift cabin. 

Normally, the lift is shut down if the substantial gap continues to exist. 

Different reactions can be triggered depending on whether the lift cabin is at rest or 
25 whether this moves. 

In the case of a lift system according to the invention the situation-dependent reaction can, 
for example In the case of a fault in the region of one of the shaft doors, allow operation of 
the lift cabin only between the permitted storeys in order to prevent travel to or passing of 
30 the storey at the shaft door of which the fault has occurred. 

In the case of a further lift system according to the present Invention the state of an 
incorrectly closed shaft door or cabin door is automatically checked in that either 
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additionally present sensors are interrogated or in that it is attempted to eliminate the fault 
by renewed opening and closing. 

The afore-described lift systems can comprise a lift controller such as described in the 
5 following. An example of such a lift controller 26 as part of a lift system 40 is shown in Fig. 
4. Such a lift controller 26 serves for controlling a drive unit 27, which moves a lift cabin 28 
with at least one cabin door along a lift shaft wall of a lift shaft with several storeys and 
shaft doors. For this purpose, the lift control 26 comprises the following 
elements/components: 

10 - Detecting means 30.1 - 30.n which are mounted each time in the region of the 
shaft doors and are connected with the lift controller 26 so that the lift controller 26 
has available fault information about the state of the shaft doors; 
Additional detecting means 34 at the lift cabin 28 and/or at the cage door or doors 
(constructed to be the same as or similar to the detecting means in the region of 

15 the shaft doors). The detecting means 34 are connected with the lift controller 26 

so that the lift controller 26 has available fault information about the state of the 
cabin door or doors: 

A status detecting unit 33 {preferably mounted in or at the lift cabin 28), which is 
connected with the lift controller 26 so that the lift controller 26 has available status 
20 information about the position and the speed of the lift cabin 28. The detecting 

means 30.1 - 30.n and 28 transmit, in the case of a fault in the region of one of the 
shaft doors or the cabin door or doors, to the lift controller 26 fault information 
about the kind of fault and position of the fault. 

25 As schematically illustrated in Fig. 4, each of the detecting means 30.1 - 30.n has an 
interface 31. n which produces a connection/linking with a bus 25. In the illustrated 
example there is concerned a bus 25 disposed to be star-shaped. In the example of the 
detecting means 30.n it is shown that such a detecting means 30.n can comprise several 
elements/components 32.1 - 32.3. 

30 

The detecting means 34 are connected by way of an interface 23 with the bus 25. The 
detecting means 34 make fault information available to the lift controller 26 by way of the 
bus 25. In addition to these detecting means 34. the lift cabin 28 comprises indicating 
elements 24.1 which indicate the direction of travel of the cabin 28, indicating elements 
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24.3 which indicate the instantaneous storey and control elements 24.2. These elements 
24.1 - 24.3 are also linked with the bus 25 by way of the interface 23. 

The status detecting unit 33 can be connected with the bus 25 by way of an own interface 
5 (not shown). The status detecting unit 33 can comprise the most diverse elements and 
sensors serving for detection of the cabin speed, position and, optionally, direction of 
travel. 

The communication and, in particular, the transmission safety between the individual 
10 components of the lift system 40 can be regulated and organised by, for example, a 
special communications unit 29. However, the communications unit 29 can also serve the 
purpose of making possible communication with other systems. For example, there can 
be placed by way of the communications unit 29 a service call which is then passed on by 
way of an external network. 

15 

The communication within the system 40 can, however, also be handled by way of a 
communications module integrated in the controller 26. 

The lift controller 26 can, with consideration of the kind of fault, the position of the fault and 
20 the status information, trigger a situation-dependent, safe reaction in order to guarantee 
residual functionality of the lift cabin notwithstanding the fault. 

The lift system according to the invention functions in the manner that in the case of a fault 
in the region of one of the shaft doors or the cabin door or doors at least one of the 
25 situation-dependent, safe reactions described further above is triggered. 

Faults of a lift system arise in part in the region of the shaft doors. In particular, the shaft 
doors 3 or 13 themselves, but also the door contacts of the shaft doors 3 and 13, are 
susceptible to fault Through the intelligence system reactions according to the invention, 
30 the functionality of the entire lift system can be increased so that in the case of certain 
faults in the region of the shaft doors persons are prevented from remaining trapped in the 
lift cabin 2 or 12. 
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The lift system can comprise detecting means 5. 20, 30.1 - 30.n in order to establish 
whether a gap formed by an incorrectly closed shaft door 3 or 13 is "substantial" or 
"insubstantiar*. A gap can be considered "substantial" and thus placing safety at risk if R 
is, for example, larger than 10 millimetres. If the gap is not substantial and thus does not 
5 place safety at risk, then - as described further above - other reactions can be triggered. 
On the next stop at the affected storey the state of the shaft door 3 or 13 can then be 
checked by opening and closing the shaft door 3 or 13. A fault of that kind can frequently 
be eliminated by such an opening and closing of the shaft door. 



10 If the gap continues to exist after opening and closing the shaft door 3 or 1 3 then a service 
call can be triggered. The lift can in certain circumstances continue to be operated, 
wherein possibly there is travel at reduced speed. This applies particularly when the gap 
was classified by the detecting means 5. 20, 30.1 - 30. n as "insubstantial". 

15 If it is established that the gap is "substantial" even before departure of the lift cabin 2 or 
12, then the shaft door 3 or 13 is opened at least once and closed again in that the lift 
cabin is moved behind the shaft door and the cabin door is opened and closed. If the 
"substantial" gap should not thereby be eliminated, the lift cabin is preferably not placed in 
motion. An announcement can be carried out or a display can light up in order to require 

20 the passengers to leave the lift cabin 2, 12. 28. 

Opened or not fully closed cabin doors are discussed in the following. As starling position 
for the flow chart according to Fig. 3 there is now considered at A a sudden report of the 
detecting means 8. 18 or 34 which reads: "cabin door open". A virtual decision stage 
25 represented by a discriminator (decision block) DO then sets the question: is the lift cabin 
2. 12 or 28 travelling? As described in the introduction, the controller 6. 16 or 26 has 
status information available which, inter alia, allows a statement about the instantaneous 
position and speed of the lift cabin 2, 12 or 28. 

30 If the lift cabin 2, 12 or 28 is still travelling (answer: yes), a situation-dependent reaction RO 
is triggered, wherein the controller 6, 16 or 26 initiates and executes a rapid stopping 
process. In addition, independently of whether the answer in the decision stage DO was 
yes or no it can be checked, for example by a reaction R1 within the scope of a plausibility 
test, whether the cage door 3 or 13 is actually open. This test can be undertaken by the 
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door drive, wherein the detecting means 8. 18, 34 check whether the cabin door 3 or 13 
could be successfully closed. Additional statements can be made if at the same time 
consideration is given to information delivered by the detecting means 5. 20, 30.1 - 30.n in 
the region of the shaft door, at the storey of which the lift cabin 2, 12 or 28 is just located. 

Thereafter, in the illustrated example a decision stage D1 queries by way of the detecting 
means 8, 18, 34 whether the cabin door 3 or 13 is open. If the answer to the decision 
stage D1 reads no, then the presumption is applicable that the cabin door 3 or 13 may be 
closed, but the closing contact of the said cabin door 3 or 13 may be open. In this case 
the cabin 2, 12 or 28 is moved, by a further reaction R2, at reduced speed to the next 
storey. Since at the start the answer was no (cabin not stationary) at the decision stage 
DO. in every case the cabin door 3 or 13 is opened (possibly the cabin door 3 or 13 is 
opened only a gap wide) by a reaction R3 and a repeated actuation of the cabin door 3 or 
13 initiated in order to attempt to eliminate the fault in this manner. The further query 
whether the closing contact is in order can be decided by a next decision stage D2: if the 
closing contact is in order, then the lift system is transferred to normal operation by a 
reaction R4. Depending on the respective form of embodiment there can be sent, together 
with a service call, a fault report to a service centre. If the dosing contact does not appear 
to be in order, then the lift system is taken out of operation by a further reaction R5 and a 
corresponding report goes to the service centre. 

If at the decision stage D1 the answer was "the cabin door is open", then it is attempted as 
reaction RIO to close the cabin door 3 or 13. Thereafter it is again queried in D20 whether 
the cabin door 3 or 13 is open: if no, normal operation is produced again by a reaction R20 
25 and at the same time a report to the service centre is triggered; if yes, a plausibility test is 
carried out by a reaction R21 . Thereafter, it is again queried by a further decision stage 30 
whether the cabin door 3 or 13 is open. If yes, there is issued as reaction R31. for 
example, a warning report *'door is open"" and the plausibility test is repeated. 

30 A subsequent query at a decision stage D40 causes as a situation-dependent reaction 
R41, if the cabin door 3 or 13 is open, the lift system to be taken out of operation and an 
emergency call to a service centre to be triggered. If, thereagainst, the response to the 
decision stage D40 was that the cabin door 3 or 13 is shut, then normal operation is 
switched on and a report to the service centre triggered. If, therefore, there is read at the 
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decision stage D30 or 40 the answer that the cabin door 3 or 13 is not open then this has 
to be interpreted that the cabin door 3 or 13 is indeed dosed, but the closing contact is 
open; this corresponds with the answer of the decision stage D1 and the "no" report of the 
decision stage D30 or D40 is executed as reaction R2. 

5 

If, however the answer: "the lift cabin is stationary" was at the decision stage DO, then the 
reactions R21 and R31 can be eliminated in such a manner that ultimately only one of the 
four situation-dependent reactions R20, R41, R4 or R5 is executed. 

10 As soon as the lift system establishes that a shaft door is open, reactions can be triggered 
in simitar manner as shown in Fig. 3, wherein, however, it is to be noted that shaft doors 
are passive doors which can be opened and closed only by the cabin door or by a special 
tool. In order to be able to automatically open and close a shaft door the lift cabin thus 
must first be moved behind the corresponding shaft door. If a shaft door was closed once 

15 by the cabin door and locked by the lock of the shaft door it is rather improbable that faults 
or problems with the shaft door come about after departure from the corresponding storey 
by the lift cabin. 

Poorly functioning shaft door and/or cabin door or doors: 

20 The shaft doors 3 or 13 and/or cage door or doors 9, 113 can be tested with respect to the 
functionality thereof by opening and closing. For that purpose, the lift system can 
systematically check by the detecting means 5, 20 or 30.1 - 30.n or by the detecting 
means 8. 18, 34, for example, the force necessary for the opening or closing. Since the 
shaft doors are passive and moved by the cabin door or doors, it is more important that the 

25 detecting means 8, 18. 34 monitor the cabin door or doors. The cabin door drive can also 
be monitored In order to establish, for example, whether an increased force is necessary in 
order to move the cabin door and the shaft door in common. If, for example, the detecting 
means 8. 18. 34 establishes that a higher force is necessary at a specific storey than in 
other storeys then it can be concluded therefrom that the shaft door 3 or 13 at the storey 

30 concerned provides problems. Then one or more of the following reactions can, for 
example, be triggered as a situation*dependent reaction: 
place a service call; 

define the corresponding storey as a non-permitted zone; . 
stop operation of the lift system. 
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The value of the force required for opening or closing can also be stored from time to time. 
Thus, a comparison of actual forces with the previously required forces is possible. In 
addition, problems in the region of the shaft or cabin doors can be recognised by this 
5 extension. 

Dealing with further faults: 

The lift system can equally be designed so that a situation-dependent reaction is triggered 
even in the case of occurrence of other kinds of faults. In that case, the controller 
preferably distinguishes between known and unknown kinds of faults. If a known type of 
fault is present then the controller can cause a situation-dependent reaction by way of a 
table entry, a decision tree of similar means. In order to design the lift system to be as 
safe as possible, on occurrence of an unknown kind of fault an immediate stopping of the 
travel operation should be canied out. An emergency call can possibly then be placed. 

In the case of monitoring of other devices or elements, for example in the case of 
monitoring the closed settings of the maintenance and emergency doors or maintenance 
panels or in the case of monitoring of the locking of the emergency panels and emergency 
force-open doors of the lift cabin, different situation-dependent reactions are possible. 
Example of a situation-dependent reaction: rapid, drive-regulated stopping at the next 
storey and allowing disembarkation of passengers. 

A lift system according to the invention can enable bypassing, in terms of software, of 
individual sensors and/or contacts or all detecting means in order to be able to produce. 
25 for example in certain sen^ice situations, states which would normally be precluded by the 
controller according to the invention. It is important that such a bypassing in terms of 
software is automatically reset after a certain time so that a possible overlooking cannot 
lead to a risk situation. 

30 According to a special form of embodiment of the invention the lift controller 26 comprises 
a software-controlled component which evaluates the signals arriving by way of the bus 25 
and triggers a reaction con-esponding with the situation. For that purpose there can be 
operation with tables, decision trees or other, similar means. 
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In order to be able to recognise the status of a lift system and thus also imminent risks, 
dispersed sensors are preferably used as detecting means, wherein in each instance two 
or more sensors could be provided for mutual checking or mutual support. The actuators, 
control blocks, drive elements or setting elements serving for carrying out the reactions 
s can be indirectly observed by way of the sensors. They are preferably designed in such a 
manner that in the case of fault they go over into the safe state (fail safe) so as not to 
negatively influence the lift system. 

The storey nodes and/or the lift controller can be provided with two or more processors in 
10 order, through this redundancy, to increase the safety of the entire system. The storey 
nodes and/or the lift controller can be self-checking in order to form a trustworthy overall 
unit. In a given case, a triple modular redundancy (TMR: Triple Modular Redundancy) can 
also be used. 

15 In another form of embodiment the functionality of the lift control can preferably be 
distributed to two or more parallelly operating node computers, wherein the control is 
executed as software tasks in the node computers. 

The different lift systems according to the invention prove particularly advantageous with 
20 respect to their high operational security, functionality and reliability, particularly since 
faults, failures, operating time faults, unexpected actions and undiscovered development 
errors can be recognised and remedied in good time. 

25 
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Patent Claims 

1. Lift system comprising a lift cabin (2; 12; 28) having a cabm door (9; 131), a drive 
unit (7; 17; 27) for moving the lift cabin (2; 12; 28) along a lift shaft wall (1.1; 1 11) provided 

5 with shaft doors (3; 13); a controller (6; 16; 26) for controlling the drive unit (7; 17; 27); 
detecting means (5; 20; 30.1 - 30. n; 8; 18; 34) which are mounted each time in the region 
of the shaft doors (3; 13) and/or in the region of the cabin door (9; 131) and which are 
connected with the controller (6; 16; 26) so that the controller (6; 16; 26) has fault 
information available; and a status detecting unit (33) which is connected with the 

10 controller (6; 16; 26) so that the controller (6; 16; 26) has status information available 
about the position and the speed of the lift cabin (2; 12; 28), characterised in that in the 
case of a fault In the region of one of the shaft doors (3; 13) the controller (6; 16; 26) 
permits operation of the lift cabin (2; 12; 28) between those storeys which can be reached 
by the lift cabin without having to pass the storey at the shaft door (3; 13) of which the fault 

15 has occurred. 

2. Lift system comprising a lift cabin (2; 12; 28) having a cabin door (9; 131), a drive 
unit (7; 17; 27) for moving the lift cabin (2; 12; 28) along a lift shaft wall (1.1; 11.1) provided 
vwth shaft doors (3; 13); a controller (6; 16; 26) for controlling the drive unit (7; 17; 27); 

20 detecting means (5; 20; 30.1 - 30.n; 8; 18; 34) which are mounted each time in the region 
of the shaft doors (3; 13) and/or in the region of the cabin door (9; 131) and which are 
connected with the controller (6; 16; 26) so that the controller (6; 16; 26) has fault 
information available; and a status detecting unit (33) which is connected with the 
controller (6; 16; 26) so that the controller (6; 16; 26) has status information available 

25 about the position and the speed of the lift cabin (2; 12; 28), characterised in that in the 
case of a fault in the region of one of the shaft doors (3; 13) the controller (6; 16; 26) 
moves the lift cabin (2; 12; 28), after the passengers have disembari<ed, into a position 
directly behind the shaft door (13; 113) of that storey in the region of which the fault has 
occurred in order to prevent a person from being able to fall through an open shaft door 

30 into the lift shaft (1; 11). 

3. Lift system comprising a lift cabin (2; 12; 28) having a cabin door (9; 131), a drive 
unit (7; 17; 27) for moving the lift cabin (2; 12; 28) along a lift shaft wall (1.1; 11.1) provided 
with shaft doors (3; 13); a controller (6; 16; 26) for controlling the drive unit (7; 17; 27); 

35 detecting means (5; 20; 30.1 - 30.n; 8; 18; 34) which are mounted each time In the region 
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Of the shaft doors (3; 13) and/or in the region of the cabin door (9; 131) and which are 
connected with the controller (6; 16; 26) so that the controller (6; 16; 26) has fault 
information available; and a status detecting unit (33) which is connected with the 
controller (6; 16; 26) so that the controller (6; 16; 26) has status information available 
5 about the position and the speed of the lift cabin (2; 12; 28). characterised in that it can be ' 
established by the detecting means (5; 20; 30.1 - 30.n; 8; 18; 34) whether a gap formed by 
an incon-ectly closed shaft door (3; 13) or cabin door (9; 131) is substantial or 
insubstantial, wherein in the case of presence of an insubstantial gap the cage can be 
further moved without restriction and a service call is placed and wherein in the case of a 
10 substantial gap during a journey the cage is controlled to a storey, which can be reached 
without passing a shaft door having a substantial gap. in order to let passengers 
disembark and/or an emergency call is placed. 

4. Lift system according to one of claims 1 to 3, characterised in that the detecting 
15 means (20; 30.1 - 30.n) of a storey are connected by way of a storey node (10) with a bus 

(15; 25) and/or the detecting means (18; 34) mounted in the region of the cabin door (9; 
131) are connected by way of a cabin node (101) with a bus (25; 151). 

5. Lift system according to claim 4, characterised in that signals from the detecting 
20 means (20; 30.1 - 30. n) of the respective storey are provided at the storey nodes, wherein 

the storey nodes (10) process these signals in order to be able to make corresponding 
fault infomiation available to the controller (6; 16; 26). 

6. Lift system according to claim 4, characterised in that the detecting means (5; 20; 
25 30.1 ' 30. n; 8; 18; 34) and/or the status detecting unit (33) is or are connected with the 

controller (6; 16; 26) byway of a safety bus (14; 151; 25). 

7. Lift system according to claim 3, characterised In that the state of the incorrectly 
closed shaft door (3; 13) or cabin door (131) is automatically checked and that 

30 - if an insubstantial gap continues to exist a service call is triggered without having to 
interrupt operation of the lift system and 

if a substantial gap continues to exist the operation of the lift system is stopped and 
an emergency call is triggered. 
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8. Lift system according to claim 3, characterised In that the controller in the case of 
presence of a substantial gap controls the cage at reduced speed to a storey which can be 
reached without passing a shaft door having a substantial gap. 

5 9. Lift system according to one of claims 1 to 3, characterised in that the status 
detecting unit (33) is mounted in or at the lift cabin (2; 12; 28). 

10. Lift system according to one of claims 1 to 3, characterised in that in the case of 
presence of a fault in the region of the cage door (9; 131) the following reaction is triggered 

10 additionally to the described reactions: 

a recovery attempt by automatic opening and closing of the cabin door (9; 131). 

1 1 . Lift system according to one of claims 1 to 3, characterised in that in addition to the 
described reactions the following reaction is triggered in the case of presence of a fault in 

15 the region of a shaft door (3; 1 3): 

travel of the lift cabin (9; 131) up to t>ehind the shaft door (3; 13) concerned and 
a recovery attempt by opening and closing the shaft door (3; 13) concerned 
through automatic opening and closing of the cabin door (9; 131). 
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